Scanning and Categorization FAQ

Why is my scan not picking up all cookies on the page?

If there are any cookies on your domain that are based on a specific user action (like a cookie dropped after a visitor adds an item to their shopping cart), a specific browser (meaning, some cookies would only fire on Chrome or Safari for instance) or a certain location, then these kinds of cookies would not be picked up by the scanner.

Cookies may also be missing for one of the following reasons:

  • Action-based cookies require a certain action (such as a button click) to get written in the browser session. The scanner does not perform any user actions today; action-based cookies are not detected by the scanner.

  • Some cookies are dropped if a user is logged into a specific service/account. For example, if a user is logged into a Google account and navigates to a website, additional cookies may drop for that user. For this scenario, there is a OneTrust Chrome scan setting. The scanner currently only supports the logged-in state for Google. OneTrust plans to expand this feature to include logged-in experiences for Facebook and X as well. 

  • Location-based cookies are only written if the data subject has a certain IP address. Certain services only get triggered if a user has a specific geolocation. The OneTrust scanner can currently replicate experiences for website visitors in Central US and North Europe only.  

  • Scripts may write cookies to only specific pages of a website. If the scanner settings are not configured to crawl those pages, either via the sitemap or target page settings, the scanner will not pick up the cookies on those pages.  

  • If a cookie pattern exists, the data like cookie name, category, description is pulled from the pattern existing in the DB.

Why are my scans results inconsistent or different from the last scan?

Any of the following could result in inconsistent scan results:

  • Changes to the website (new services added, modified code) since the last scan.

  • Changes in the scan configuration (target pages, etc.).

  • Use of sitemaps or change in sitemaps.

  • Safelisting of scanner IPs.

Does the scanner follow robot.txt present on the domain?

The scanner checks robots.txt for a sitemap on any scan that does not have any sitemap URLs provided. The check is skipped if a sitemap is provided in the scan request.

Can the OneTrust scanner pass through multi factor authentication or onetime passwords?

Yes, the OneTrust scanner can be configured to login with multi-factor authentication or onetime passwords.

What can I do if my scan is in a "Scan Error" state?

"Scan Error" typically means the scan has actually been completed, but the data processing from the scanner to your tenant database has failed. Please verify that the website is accessible from Northern Ireland since that is where the scanner server is located and re-scan the domain. You can contact OneTrust Support to enable US-based scanner feature that will allow you to scan the domain from Central US.

For more information, see Scanning a Website.

Why is the Scan button is greyed out and preventing me from running new scans?

  1. Ensure that you have the right permissions.

  2. Review the scanner settings for incorrect URLs or mandatory fields that are not filled in.

  3. Expand the Advanced Settings section on the Add Website screen and check if there are any required fields left empty or any incorrect URLs inputted in sitemaps or target pages. If the URLs are entered without the protocol, you need to add https://.

Why is the scanner only picking up one page and moving to "Completed"?

  • There are multiple reasons the scanner could only be picking up one page. This could be due to safelist error, an external re-direct the site is forcing, something on the site such as a "Welcome" pop up inhibiting the scanner from continuing, or login issues.

  • To test for an external re-direct, navigate to the page while VPN'd to the same geolocation the scanner is originating from. Watch closely to see if it redirects you to a different domain. For more information on scanner IPs, see About OneTrust Hosting Options, Locations and Backup.

  • To test for a safelist error, see if you are able to access the site from your browser. It may also help to VPN into the geolocation of the scanner.

  • For login issues, check your login credentials to make sure you were able to access the site

  • If there are no discernible errors, navigate to the site in your browser and try to determine if there is a pop up that may be blocking any additional movement in the page

Please note that these are example use-cases for the scanner picking up only one page and not an exhaustive list of reasons.

Can the scanner access sites behind an OpenID Connect (OIDC) login re-direct?

Re-directs are now supported. You will need to configure the root path as an expected re-direct in the login configuration.

Why is the scan behind login not working?

The OneTrust scanner cannot recognize the submit button if it does not have a "name", “class” or "id" value. You will need to ensure that the buttons either have a "name", “class” or "id" value. Additionally, check the HTML inputs and values as well, to make sure they are entered correctly and note that if the login button is disabled, the login will not work.

For more information, see Scanning Behind Authentication.

Why are post‑login local storage objects missing from my scan results?

If your site uses storage objects that are set post‑login, these may not be captured; pages treated as already visited after login are not re‑crawled. Add these post-login pages manually when configuring your scan.

Why did I get a red toaster error when submitting my scan?

There could already be a scan already in progress or categorizing. Please double check if the domain is already in process in the application. If you would like to re-scan, please delete the scan and re-start.

Is there a limit to how many domains we can scan?

There is not a limit to the number of domain scans in a certain tenant. However, the number of production scripts that you can publish depends on the number of licenses you have purchased.

Should we scan a domain with www. in the URL or without?

If you scan www.domain.com, the related scripts will function only on this sub-domain and anything that comes under www.domain.com (for example, www.domain.com/page).

If you scan the root domain (domain.com), the scripts can be utilized on any sub-domains, pages, or URLs that come under the root domain (e.g., www.domain.com, xyz.domain.com, domain.com/page, etc.).

If you would like to have unique experiences on each of your sub-domains (for example, www.domain.com has a different experience and its own consent as compared to abc.domain.com), you can scan these separately. Otherwise, the root domain scan, domain.com, will cover everything.

Should we scan test websites along with the production websites in the OneTrust tool?

You are not required to scan test websites alongside production sites. When you add a domain for scanning, it will generate a test as well as production script. The test script can be used on any domain, irrespective of whether you have it added in the OneTrust tenant or not. Hence, if the main purpose of scanning the test website is to have the scripts available for testing, then it is not mandatory to scan the test website.

Does the scan export include manually added cookies?

If you would like for the scan report to include manually added cookies, you can export the list by navigating to Tracking technologies tab and clicking the Export icon. This report will include all cookies (including manually added) with the latest categorizations. Scan reports generated from the Websites or Website details screens will not include manually added cookies.

For more information, see Managing Tracking Technologies.

Can multiple users receive notifications when a scheduled scan is completed?

Currently, OneTrust can notify only one user when a scheduled scan is completed. You can add a distribution list to notify multiple users at once.

Can you export the code for the Banners, Preference Centers, and Cookie Lists?

This is not currently available but a public API to allow this feature is under development.

Is there a way to get the HTML or CSS code used for Cookie Banners, Preference Center, and Cookie Lists?

You can get the HTML or CSS code by executing Optanon.getHTML() or Optanon.getCSS() respectively.

How are cookies are displayed in the cookie list when scanning and implementing scripts for different domains?

If you have scanned multiple domains, such as example.com and example1.com, and the scanner identifies cookies as follows:

  • example.com: _ga and _fbp

  • example1.com: _gcl and YSC

When you implement the script for example.com and embed its cookie list script, the cookie list will only display cookies identified for example.com (_ga and _fbp). Cookies from a different domain (e.g., _gcl and YSC from example1.com) will not appear in the example.com cookie list.

What changes will the Cookiepedia AI Categorization introduce to the OneTrust application?

The enhancement is purely backend. The only change you will notice is that once an unknown cookie is identified during a scan, the automated pipeline will pass that cookie details to an AI classifier, which will categorize it. OneTrust then updates Cookiepedia with the cookie category and description. You will see this change during the next rescan.

Can I still override cookie categories when leveraging Cookiepedia AI Categorization?

Yes, you can still manually override the category of a cookie. This enhancement provides a better default category for all Unknown cookies.

Does the Cookiepedia AI Categorization collect tenant-specific information from my scans?

There is no tenant-specific data that maps cookies to which page/domain it was found on.

Are tracking technologies found via scan only accessible to users in my specific sub-organization?

No. Tracking technologies found via scan are accessible across your entire tenant, including other sub-organizations. Scanned technologies are not separated based on sub-organization.